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CROSS REFERENCE TO RELATED APPLICATION 
This application is based upon and claims the benefit of 
Japanese Patent Application No. 2001-28459 filed on February 5, 
2001, the contents of which are incorporated herein by reference. 

BACKGROUND OF THE INVENTION 

1 . Field of the Invention 

The present invention relates to an electronic control 
system and method that are capable of detecting microcomputer 
malfunction by monitoring operations of one microcomputer by 
another one. Especially, the present invention relates to a 
throttle control microcomputer and method that conduct 
electronic throttle control of an engine of a vehicle. 

2. Related art 

Electronic control systems have the monitoring function 
to detect a microcomputer malfunction by monitoring operations 
of a plurality of microcomputers one another. For example, an 
electronic control system of a vehicle has an engine control 
microcomputer for executing engine control (spark ignition, fuel 
injection or the like) and a throttle control microcomputer for 
executing electronic throttle control. A monitoring program is 
provided in the engine control microcomputer, thereby to monitor 
the throttle control microcomputer in the engine control 
microcomputer. For instance, in U.S. Patent No. 6,230,094 
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{ JP-A-11-294252 ) , an engine control microcomputer monitors a 
throttle control microcomputer. When the engine control 
microcomputer detects malfunction of the throttle control 
microcomputer, the engine microcomputer resets the throttle 
5 control microcomputer and executes the throttle control in place 
of the throttle control microcomputer. 

In order to increase reliability and safety of the throttle 
control microcomputer, it is desired to monitor operations of 
the monitoring program itself. Therefore, in JP-A-11-294252, 
10r watch-dog pulse is outputted periodically, and the watch-dog 
pulse is inputted a watch-dog timer. Thus, monitoring program 
is watched. It is, however, required to provide a hardware IC 
to watch the monitoring program. 



IS SUMMARY OF THE INVENTION 

r= It is therefore an object of the present invention to 

provide an electronic control system, which is capable of 
obviating the above problem. 

It is another object of the present invention to provide 
20 an electronic control system, which is capable of attaining a 
monitoring function of a microcomputer. 

According to the present invention, a first microcomputer 
is programmed to control a first object such as a fuel injection 
or ignition timing of an engine. The first microcomputer has a 
25 monitor program for checking malfunction of a second 
microcomputer periodically. The second microcomputer is 
programmed to control a second object such as a throttle driving 
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motor. The first microcomputer comprises a timer and a timer 
setting unit. The timer increases or decreases time count in 
proportion to time, and switches its output logic level of its 
port when the time count reaches a predetermined time. The timer 
5 setting unit sets new time count in place of the time counted 
by the timer when an operation of the second microcomputer is 
normal and the monitor program is normal. 



BRIEF DESCRIPTION OF THE DRAWINGS 
1© Other objects, features and advantages of the present 

invention will be understood more fully from the following 
r: detailed description made with reference to the accompanying 
~ drawings. In the drawings: 

: = FIG. 1 is a block diagram showing an electronic control 

15 = system for engines according to a first embodiment of the present 
S invention; 

FIG. 2 is a flow diagram showing a base routine executed 
by an engine control microcomputer in the first embodiment; 

FIG. 3 is a flow diagram showing an interrupt routine 
20 executed by the engine control microcomputer in the first 
embodiment ; 

FIG. 4 is a timing diagram showing a check processing of 
the monitor program in the first embodiment; 

FIG. 5 is a block diagram showing an electronic control 
25 system for engines according to a second embodiment of the present 
invention; and 

FIG. 6 is a flow diagram showing an interrupt routine 
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executed by the engine control microcomputer according to a third 
embodiment of the present invention. 

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 

5 (First embodiment) 

An electronic control system has an electronic control unit 
(ECU), which has a plurality of microcomputers. The 
microcomputers execute engine control such as fuel injection 
control, fuel ignition control, electronic throttle control or 
10; the like, respectively. 
Z As shown in FIG. 1, the ECU 10 is equipped with an engine 

,■7 control microcomputer 11 for executing engine control, and an 
.£ electronic throttle control microcomputer 12 for executing 
electronic throttle control. These microcomputers 11, 12 are 
15, connected with each other, and are capable of serial communication 
= therebetween . 

The engine control microcomputer 11 receives an accelerator 
position signal, throttle position signal and other engine 
condition signals such as a rotation speed signal. It calculates 
20 required ignition timing and fuel injection amount based on the 
received signals, and produces control signals to an igniter and 
an injector. 

The throttle microcomputer 12 receives the accelerator 
position signal and the throttle position signal. It calculates 
25 required throttle position for throttle control based on the 
received signals, and produces a control signal to a motor drive 
circuit 13, which comprises H-bridge circuit. The motor drive 
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circuit 13 is connected to a throttle motor 22 of a throttle 
actuator 21. The throttle motor 22 drives a throttle valve (not 
shown) and adjusts an amount of intake air supplied to the engine. 

The engine control microcomputer 11 is programmed to 
produce a WDC pulse to a WDT (watch-dog timer) 14, so that the 
WDT 14 may monitor the operation of the engine control 
microcomputer 11 based on the received watch-dog pulse. In this 
case, when the WDT 14 detects malfunction of the engine control 
microcomputer 11, for example a periodicity of the WDC pulse is 
out of order, the WDT 14 products a reset signal to the engine 
control microcomputer 11. Therefore, the engine control 
microcomputer 11 is reset. 

The engine control microcomputer 11 has a monitor program 
to be executed for monitoring operations of the throttle control 
microcomputer 12. The engine control microcomputer 11 is 
programmed to execute the monitor program as a periodic interrupt 
routine, so that the monitor program is executed in a 
predetermined frequency. The engine control microcomputer 11, 
in executing the monitor program, for example, compares results 
of calculation made on the same data by the engine control 
microcomputer 11 and the throttle control microcomputer 12, and 
detects malfunction of the throttle control microcomputer 12 when 
the compared calculation results differ from each other. 

The engine control microcomputer 11 has a timer 15. The 
timer 15 is set a predetermined time each time when the monitor 
program is accomplished normally. The timer 15 has output 
compare function. The timer 15 switches automatically its output 



logic level from high to low of its port (throttle relay port 
A) , when the time count is decreased to zero. 

The timer 15 controls a transistor 16 based on the output 
logic level of the throttle relay port A. Namely, when the output 
5 logic level of the throttle relay port A is high, the transistor 
16 is turned on to open a motor relay 23. Therefore, the motor 
drive circuit 13 is supplied with electric power from a battery 
to drive the throttle motor 22 . On the other hand, when the output 
logic level of the throttle relay port A is low, the transistor 
10i 16 is turned off to close the motor relay 23. Therefore, motor 
S drive circuit 13 is not supplied with electric power from the 
*Z battery to stop the throttle motor 22. 

= The engine control microcomputer 11 is programmed to 

execute a base routine shown in FIG. 2 and an interrupt routine 

15, shown in FIG. 3. 
=5 As shown in FIG. 2, after power-on of the ECU 10, the engine 

control microcomputer 11 executes an initialization processing 
at step 101. In this initialization processing, the output logic 
level of the throttle relay port A is initialized. Namely, when 

20 the time count of the timer 15 is not zero, the output logic level 
of the throttle relay port A is set high. When the time count 
of the timer 15 is zero, the output logic level of the throttle 
relay port A is set low. Next, the engine control microcomputer 
11 executes an engine control processing at step 102 to calculate 

25 the required ignition timing and fuel injection amount in the 
known manner. 

The interrupt routine, shown in FIG. 3, is executed every 
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16 ms. As shown in FIG. 3, the engine control microcomputer 11 
executes monitor processing at step 201 in the known manner. For 
instance, the engine control microcomputer 11 checks (1) whether 
the monitor program is started and ended accurately (entry /end 
5 check), (2) whether the monitor program is executed in the 
predetermined order, (3) whether the throttle position signal 
calculated by the throttle control microcomputer 12 is equal to 
the throttle position signal calculated by the engine control 
microcomputer 11 or the like, as the monitor processing. Thus, 

ICE if one of the monitor processing is detected as abnormal 
(malfunction), the engine control microcomputer 11 sets an error 
flag indicative of the malfunction. Here, it is possible to 
dispense with above mentioned ( 1 ) or ( 2 ) . 
iu. Next, at step 202, the engine control microcomputer 11 

IS- checks whether the monitor processing at step 201 is normal. The 
; processing advances to step 2 03 in response to an affirmative 
determination (YES). Then, the engine control microcomputer 11 
checks whether the time count of the timer 15 is in a predetermined 
acceptable region (e.g., 60 to 68 ms ) . Thus, the processing 

20 advances to step 204 in response to an affirmative determination 
(YES), and the engine control microcomputer 11 sets a 
predetermined time (e.g., 80 ms) as the initial time count of 
the timer 15. 

The processing advances to end this routine in response 
25 to a negative determination (NO) at step 202 or 203. Namely, when 
the monitor processing detects the malfunction at step 201, or 
when the executing timing of the monitor program is not equal 
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to predetermined timing (e.g., 16 ms), timer 15 is not set with 
the predetermined time (e.g., 80 ms ) . 

As shown in FIG. 4, before timing tl, the throttle control 
microcomputer 12 is not detected as malfunctioning and the monitor 
program is executed normally. Therefore, the timer 15 is set with 
the predetermined time (80 ms) at every 16 ms indicative of the 
executing interval of the monitor program. Namely, before 16 ms 
passes, the timer 15 is set with the predetermined time over and 
over again. In this case, the output logic level of the throttle 
relay port A is maintained high. Thus, the motor relay 23 is 
closed, and the electric power supplied to the throttle motor 
22 is maintained. 

On the other hand, for example, when the malfunction of 
the throttle control microcomputer 12 is detected or the monitor 
program is not executed normally at timing tl, the timer 15 will 
never be set with the predetermined time ( 80 ms ) . Then, at timing 
t2, when the time count of the timer 15 is zero, the output logic 
level of the throttle relay port A is switched low. Thus, the 
motor relay 23 is opened, and the electric power supplied to the 
throttle motor 22 is stopped. As a result, controlling the amount 
of intake air supplied to the engine by the throttle actuator 
21 is stopped. 

According to this embodiment, the timer function that is 
equipped in normal microcomputer is used for monitoring operation. 
Therefore, a hardware IC for the monitoring operation is not 
required. Therefore, ECU 10 can be simplified. 

Furthermore, when the malfunction of the throttle control 



microcomputer 12 is detected or the malfunction of the monitor 
program is not executed as designed, the output logic level of 
the throttle relay port A is switched from high to low, and 
electronic throttle control is stopped. Thus, the ECU 10 
5 monitors properly whether electronic throttle control is 
executed normally. 

Moreover, the ECU 10 monitors the interval of executing 
time of the monitor program based on the time count of the timer 
15. When the interval is within the acceptable region, the timer 
Iff 15 is set with the predetermined time (80 ms ) . Therefore, when 
the monitor program is executed in too short time or too long 
Q time, the ECU 10 detects the malfunction of the throttle control 
==: microcomputer 12 or the monitor program. 

In this embodiment, it is possible to set the predetermined 
15,= time for monitoring the WDC pulse equal to the predetermined time 
2= for monitoring the monitor program. The predetermined time to 
set in the timer 15 may be suitably changed. 
(Second embodiment) 

In the second embodiment, shown in FIG. 5 one microcomputer 
20 (main microcomputer) 31 of an ECU 30 has both engine control 
function and throttle control function, and another 
microcomputer (auxiliary microcomputer) 32 has only monitoring 
function. For instance, a 3 2 -bit microcomputer is used as the 
main microcomputer, and a 16- or 8-bit microcomputer is used as 
25 the auxiliary microcomputer 32. 

As shown in FIG. 5, ECU 30 is equipped with the main 
microcomputer 31 and the auxiliary microcomputer 32. The main 



microcomputer 31 executes engine control and electronic throttle 
control. Namely, the main microcomputer 31 calculates the 
required ignition timing and fuel injection amount for engine 
control, and throttle position for throttle control- The main 
5 microcomputer 31 outputs a WDC pulse to WDT 33. Thus, the WDT 

33 monitors malfunction of the main microcomputer 31 as in the 
first embodiment. Incidentally, a signal based on the calculated 
results by the main microcomputer 31 is transmitted to the motor 
drive circuit 35 through the auxiliary microcomputer 32. 

10==: The auxiliary microcomputer 32 monitors the throttle 

control executed by the main microcomputer 31. The auxiliary 
microcomputer 3 2 has a monitor program for executing at every 
7* predetermined interval. According to the monitor program, the 
: Ul auxiliary microcomputer 32 detects whether the calculation of 
15= the main microcomputer 31 is accurate, whether the monitor program 
C is started and ended accurately or whether the monitor program 
is executed in the predetermined order. 

The auxiliary microcomputer 32 has a timer 34. The timer 

34 is set with a predetermined time every time when the monitor 
20 program is accomplished normally. The timer 34 has output 

compare function. The timer 34 is switched automatically from 
high to low, when the time count is decreased to zero. Thus, 
throttle motor driving is controlled by a motor drive circuit 

35 based on the output logic level of the port. 

25 In this case, when the time counted by the timer 34 is not 

zero, the throttle motor is operable. On the other hand, when 
the time counted by the timer 34 is zero, the throttle motor is 
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not operable. 

(Third embodiment) 

As shown in FIG. 6, in the third embodiment, the monitor 
processing advances to step 205 in response to a negative 
determination (NO) at step 202 or 203. Thus, the engine control 
microcomputer 11 sets zero as the time count of the timer 15, 
and the output logic level of the throttle relay port A is switched 
to low, immediately. Therefore, when the malfunction of the 
throttle control microcomputer 12 is detected or the monitor 
program is not executed normally, the throttle motor 22 is stopped, 
immediately . Thus , ECU 1 0 executes throttle control more safely . 

(Modifying embodiment) 

In the first to third embodiments, a timer for increasing 
time count can be utilize in place of the timer 15, 34 for 
decreasing time count. When the time counted by the timer reach 
a predetermined time, an output logic level of a port is switched. 
In this case, when the throttle control function is not detected 
as malfunctioning and the monitor program is executed normally, 
the timer is reset to zero each time. To the contrary, when the 
throttle control function is detected as malfunctioning and the 
monitor program is not executed normally, the timer is not reset 
to zero. Thus, when the timer is not reset, the time counted by 
the timer reaches the predetermined time (e.g. , 80 ms), the output 
logic level of the port is switched. 

The microcomputer that monitors the other can be adapted 
to a microcomputer utilized for ABS or bag air. 



